Medium and large companies. Also micro and small companies in the timber sector.
EUDR · Regulation (EU) 2023/1115
EUDR: scope, roles and obligations before 30 December 2026
A practical guide to the EU Deforestation Regulation: who it applies to, the four roles, the new Annex I and the timeline. In ten minutes you know if it applies to you and with which role. It was postponed twice; not this time.
- The obligations do not change, what changes is who meets them and how they are declared
- Annex I changed on 13 July 2026, in both directions
- Your real deadline is mid-December, not the 30th
Updated 4 August 2026 · includes the delegated act of 13 July
Executive summary
The EUDR in six figures
The rest of micro and small enterprises.
Cattle, cocoa, coffee, oil palm, rubber, soy and wood. These have not changed.
Production on land deforested after this date: non-compliant product.
A fine of at least 4% of annual EU turnover, plus confiscation and exclusion from public procurement (art. 25).
From ~€8.1bn to ~€2bn per year, estimated after simplification (COM(2026) 191 final).
The thesis
What has really changed in 2026
Not the underlying obligations, but who meets them and how they are declared. Due diligence stays the same; the division of work along the chain does not.
If your last scope review is from 2024 or 2025, you are working with a wrong list in both directions: you have products in scope that have already left, and products out of scope that have already entered.
Timeline
The EUDR timeline
Fewer than five months remain until the first date. The two previous extensions no longer have an argument: the system reopened at the end of June and the guidance was adopted on 13 July. Plan against 30 December 2026.
- 29 Jun 2023
Entry into force
Regulation (EU) 2023/1115
- 30 Dec 2024
Postponed
First scheduled date
- 30 Dec 2025
Postponed
Regulation (EU) 2025/2650
- 4 May 2026
Simplification
Report COM(2026) 191 final
- 13 Jul 2026
Acts adopted
Annex I and information system
- 30 Dec 2026
Application
Medium and large, and timber. EUTR repealed
- 30 Jun 2027
Micro and small
Remaining sectors
- 30 Dec 2027
New products
Instant coffee and palm derivatives
30 Dec 2026
Full obligation for medium and large companies, and for micro and small companies in the timber sector. The EUTR is repealed.
30 Jun 2027
The rest of micro and small enterprises enter, with a simplified declaration.
30 Dec 2027
The new Annex I entries apply: instant coffee, palm derivatives and other codes.
Scope check
Does the EUDR apply to you? The five questions
Run this check by product, not by company. The same company is often an operator on some lines and a downstream operator on others.
1
Does your product contain, has it been fed on, or was it made with any of the seven commodities?
Cattle, cocoa, coffee, oil palm, rubber, soy and wood. The list has not changed since 2023.
NO
Out of scope. Keep the reasoning in writing: it is exactly what your client will ask you for.
YES
Go to question 2. Note: the soy feed of an animal counts.
2
Does the HS code of your product appear in the Annex I in force?
Work from the Annex I consolidated after the delegated act of 13 July 2026, not from 2024 lists.
NO
Out. What has left includes bovine hides and leather (4101, 4104, 4107), retreaded tyres, soy for sowing and printed products in chapter 49.
YES
Go to question 3. Also check the entries that apply from 30 December 2027.
3
Do you place the product on the Union market, trade it within the Union or export it from the EU?
Export from the EU is also covered. It is the most common scope error in supply chains.
NO
Out of the EUDR. Operations entirely outside the Union.
YES
You are in. Move on to determine your role and your date.
4
Are you the one placing that product on the Union market for the first time?
Importing from a third country or exporting from the EU makes you an operator. Receiving a product someone else already declared does not.
NO
Downstream operator, if you transform or re-place the product on the market under your name. If you only distribute it, you are a trader.
YES
Operator. Full due diligence and your own declaration.
5
What size is your company and in which sector does it operate?
Size is determined according to the Union SME definition.
NO
Micro or small (other sectors): from 30 June 2027, with a simplified declaration.
YES
Medium or large, or micro and small in the timber sector: application from 30 December 2026.
Keep the reasoning, not just the result. An inspection does not ask what role you have: it asks how you reached that conclusion. A one-page document per business line, dated and signed, resolves half the conversation.
Division of work
The four EUDR roles
The December 2025 reform did not relax due diligence: it concentrated it in the first link and created the downstream operator figure for everything that comes after.
| Role | Due diligence | Declaration | From |
|---|---|---|---|
| Primary operator (medium or large) | Full: information, risk assessment and risk mitigation. | Own DDS before placing on the market or exporting. Includes the estimated annual quantity. | 30 Dec 2026 |
| Primary operator (micro or small) | Full, with lighter documentary obligations. | Simplified declaration. | 30 Jun 2027 (timber: 30 Dec 2026) |
| Downstream operator (new figure) | Does not repeat the due diligence of the first link. | Does not submit its own DDS. Collects and keeps the reference number of the initial declaration and passes it downstream. | 30 Dec 2026 |
| Trader (distribution) | Not applicable as such. | Documentary obligations. Non-SME traders no longer submit a DDS in most cases. | 30 Dec 2026 |
If you are a downstream operator, your job is not to geolocate plots, it is to capture and file reference numbers. You need a field for it in the ERP and a blocking rule if goods arrive without one. The documentation is kept for five years.
Annex I · delegated act of 13 July 2026
What changed in Annex I
If your last scope review is from 2024 or 2025, you are working with a wrong list in both directions.
Out of scope · immediate effect
- Bovine hides and leather (4101 · 4104 · 4107)Good news for footwear and leather goods: these product lines leave the perimeter through this route.
- Retreaded tyresThe rest of tyres and rubber components remain in scope.
- Soy for sowingSoy destined for feed and processing does not change.
- Printed products (chapter 49)Books, newspapers and pictures already left in the December 2025 reform.
In scope · from 30 Dec 2027
- Instant coffeeIt hits roasters and coffee distribution head-on.
- Certain palm oil derivativesFood and cosmetics: check the technical sheets of your formulations, not just the crude oil.
- Frozen bovine tonguesAn example of why scope is checked by HS code and not by product family.
The delegated act is not yet final: it is in the scrutiny period of the European Parliament and the Council, two months and extendable, during which they can only veto it, not amend it. Work with these codes now, but confirm the final version before closing your scope matrix.
Risk by country
Low risk does not mean exemption
It is the most expensive misunderstanding out there. Classification of 22 May 2025.
High risk
4 countries: Belarus, Myanmar, North Korea and Russia
Standard risk
~50 countries, including Brazil, Indonesia and Malaysia
Low risk
The remaining ~140 countries
With low risk you still must
- Collect the geolocation of the plots
- Prove legality at origin
- Submit the declaration
With low risk you do not need
- The formal risk assessment
- The mitigation measures
- Unless information appears pointing to non-compliance
Do not build your sourcing strategy on the current classification: it is reviewed in 2026 with the new FAO data. Authorities must inspect each year 9% of operators with products from high-risk countries and 3% in standard risk.
The procedure
Due diligence, in three steps
There are no shortcuts between steps: you cannot assess the risk without the geolocation, and you cannot declare with a risk that is not nil or negligible.
Step 1 · Information collection
Data by product and by batch, not by supplier.
- Description, HS code and quantity
- Geolocation of the plots; polygon if over 4 ha
- Country of production
- Date or period of production
- Applicable legal reference at origin
Step 2 · Risk assessment
Risk that the product is non-compliant, cross-referencing origin, chain and complexity.
- Risk classification of the country or region
- Presence of forests and of indigenous peoples
- Complexity of the chain and degree of mixing
- Reliability of the information received
Step 3 · Mitigation
You can only declare if the risk is nil or negligible.
- Additional information or audit at origin
- Supplier support and reinforced traceability
- Change of supplier if it cannot be closed
- Annual review of the system
New in 2026: the declaration now requires including the estimated annual quantity of the product. The point that breaks the timelines is not step 2 or 3, but step 1: gathering coordinates for thousands of plots from small producers takes months, not weeks.
Enforcement
Who enforces the EUDR
Each member state designates its competent authority. Customs and market surveillance bodies carry out much of the control on the ground, and the declarations feed the Commission information system.
Competent authority
Each member state designates its competent authority for the application and enforcement of the regulation.
Coordination between authorities
Customs and market surveillance bodies coordinate the controls carried out on the ground.
National information repository
The declarations and reference numbers feed the Commission information system, accessible to the authorities.
EUTR transitional regime
The EUTR is repealed on 30 December 2026, but continues to apply on a transitional basis until 31 December 2029 for wood produced before 29 June 2023.
| Penalty (art. 25) | Scope |
|---|---|
| Fine | At least 4% of the company annual turnover in the Union. |
| Confiscation | Of the products concerned and of the revenue obtained from them. |
| Exclusion | From public procurement and from access to public funding. |
Prepare the file now and keep four things to hand: the scope matrix by product, the signed due diligence procedure, the declarations and reference numbers from the last five years, and the evidence on which you assessed the risk. With that, an inspection is a morning. Without it, it is weeks.
Actionable
The 20-week plan
If you are running late, order matters more than the calendar: without the product inventory, nothing else can be done well.
| Weeks | What to do | Who | Internal deliverable |
|---|---|---|---|
| 0 | Appoint a single owner of the file. One person with ERP access and authority to block a purchase. Without that name, the plan does not start. | General management | Appointment record |
| 1–3 | Inventory of products and HS codes. Extract from the ERP every product bought, sold and exported. Cross-check them against the Annex I in force. | Procurement + IT | Scope matrix |
| 4–6 | Role and size classification. By business line: operator, downstream operator or trader. One company may hold several roles. | Compliance + Management | Role map |
| 7–12 | Supplier data campaign. Request with the five fields, weekly follow-up and escalation. The longest block and the one most underestimated. | Procurement | Response log |
| 13–16 | Tests in the information system. User onboarding, test declarations and a decision on web interface or API. | Compliance + IT | Test report |
| 17–20 | File closure and internal training. Activate the contingency plan. Define the blocking criterion beforehand, not in December. | Compliance + Quality | File per family and plan B |
Keep the last two weeks of December free: neither the system nor your suppliers work at full capacity between Christmas and New Year. If you start in August, you make it. If you start in October, you will have to prioritise by volume and accept that some products drop out of the catalogue in January.
Not going to make the deadline, or not sure where to start?
You can run this plan on your own, but you do not have to. In a 30-minute diagnosis we review your scope matrix with you, confirm your role in the chain and tell you which blocks you can skip. It is the same work, done with someone who has set it up dozens of times.
What goes wrong
The eight most common mistakes
Confusing postponement with repeal
The application date was postponed, the rule was not withdrawn. The text in force dates from June 2023.
Assuming low risk means exemption
With low risk there is still geolocation, proof of legality and a declaration.
Forgetting that export is covered
Taking product out of the EU triggers the same obligations as bringing it in.
Treating wood packaging as a product in scope
Support packaging is out. The paper or cardboard product you sell is not.
Not keeping the reference numbers received
For a downstream operator, that number is the compliance. Without a field in the ERP, it is lost.
Not keeping the documentation for five years
It includes the evidence on which the risk was assessed, not just the declaration.
Taking a sustainability certificate as enough
It supports the risk assessment. It does not replace due diligence or geolocation.
Waiting for the IT system
The system is already open. Every week without tests is a week without knowing which data you are missing.
And a ninth, which is not a matter of interpretation: leaving it to a single person. The file touches procurement, quality, IT and management. If only one person knows where each piece of data is, the real risk is not regulatory.
No commitment
Book your 30-minute EUDR diagnosis
Half an hour to know where you stand. We review your situation with you, no sales pitch:
- We review your scope matrix by product and HS code
- We confirm your role: operator, downstream operator or trader
- We tell you which blocks of the 20-week plan you can skip
- We flag the products that left or entered with Annex I
Prefer to review it yourself first? See the compliance calendar with every key sustainability deadline for the period, in order.
Common questions
Frequently asked questions about the EUDR
What is the EUDR?
The EUDR is Regulation (EU) 2023/1115 on deforestation-free products. It requires proof that certain products placed on the EU market, traded within it or exported from it do not come from land deforested after 31 December 2020 and were produced in line with the legislation of the country of origin. It covers seven commodities (cattle, cocoa, coffee, oil palm, rubber, soy and wood) and their derivatives by HS code, and is met with a documented due diligence procedure and a declaration in the Commission information system.
When does the EUDR start to apply?
On 30 December 2026 for medium and large companies, and for micro and small companies in the timber sector. On 30 June 2027 for the rest of micro and small enterprises. And on 30 December 2027 for the new Annex I entries.
Will the EUDR be postponed again?
The two previous extensions were approved with the information system unfinished and the guidance unpublished. In 2026 both are done: the system reopened at the end of June and the updated guidance was adopted on 13 July in all EU languages.
Which products does the EUDR affect?
Seven commodities (cattle, cocoa, coffee, oil palm, rubber, soy and wood) and their derivatives identified by HS code. The list of commodities has not changed since 2023; the Annex I list of codes has.
What left the scope in July 2026?
Bovine hides and leather (4101, 4104, 4107), retreaded tyres and soy for sowing. Printed products in chapter 49 had already left in the December 2025 reform.
What entered the scope?
Instant coffee, certain palm oil derivatives and frozen bovine tongues, applicable from 30 December 2027.
What is a downstream operator?
It is the figure created in the December 2025 reform. It does not repeat the due diligence of the first link nor submit its own DDS: it collects, keeps and passes downstream the reference number of the initial declaration.
Does the EUDR affect me if I only export from the EU?
Yes. Export from the Union triggers the same obligations as placing on the market. It is the most common scope error in supply chains.
If my supplier is in a low-risk country, am I exempt?
No. With low risk you save the formal risk assessment and mitigation measures, but the geolocation of the plots, the proof of legality at origin and the declaration are done just the same.
Is my supplier sustainability certificate enough?
It does not replace due diligence. It can support the risk assessment, but it does not replace geolocation or the proof of legality.
What penalties apply for breaching the EUDR?
A fine of at least 4% of annual turnover in the Union, confiscation of the products concerned and of the revenue obtained from them, and exclusion from public procurement and from access to public funding (art. 25).
Who enforces the EUDR?
The competent authority designated by each member state, with customs and market surveillance bodies carrying out much of the control on the ground.
How long must the EUDR documentation be kept?
Five years. It includes the declarations, the reference numbers received and the evidence on which the risk was assessed, not just the declaration.
Dcycle is the ESG data platform where more than 2,000 companies centralise their carbon footprint, CSRD, EcoVadis and CDP. Need to operate the EUDR by product, batch and supplier? See how to structure your supply chain data and turn scattered supplier requests into one controlled flow.
Half an hour to know where you stand
A free 30-minute diagnosis: we review your scope matrix, confirm your role in the chain and tell you which blocks of the 20-week plan you can skip. No commitment and no sales pitch.
Book the diagnosis